From 5f5b9f164822a5c2b21073ff1cc7b5d7debdf441 Mon Sep 17 00:00:00 2001
From: Miro <200482516+Mirochill@users.noreply.github.com>
Date: Sat, 10 Oct 2026 23:36:27 +0200
Subject: [PATCH] Validate compressed A2S responses with unsigned CRC32

Assisted-by: OpenAI Codex
---
 steam/game_servers.py                 |  7 +--
 tests/test_game_servers_compressed.py | 67 +++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 3 deletions(-)
 create mode 100644 tests/test_game_servers_compressed.py

diff --git a/steam/game_servers.py b/steam/game_servers.py
index 80bf1083..92d5f20b 100644
--- a/steam/game_servers.py
+++ b/steam/game_servers.py
@@ -286,13 +286,14 @@ def _handle_a2s_multi_packet_response(sock, packet):
 
     # decompress response if needed
     if compressed:
-        size, checksum = _unpack_from('<ll', packet, 10)
+        size, checksum = _unpack_from('<lL', packet, 10)
         data = _bz2_decompress(data)
 
         if len(data) != size:
             raise RuntimeError("Response size mismatch - %d %d" % (len(data), size))
-        if checksum != crc32(data):
-            raise RuntimeError("Response checksum mismatch - %d %d" % (checksum, crc32(data)))
+        actual_checksum = crc32(data) & 0xffffffff
+        if checksum != actual_checksum:
+            raise RuntimeError("Response checksum mismatch - %d %d" % (checksum, actual_checksum))
 
     return data
 
diff --git a/tests/test_game_servers_compressed.py b/tests/test_game_servers_compressed.py
new file mode 100644
index 00000000..da8c0201
--- /dev/null
+++ b/tests/test_game_servers_compressed.py
@@ -0,0 +1,67 @@
+import bz2
+from binascii import crc32
+from struct import pack
+import unittest
+
+import mock
+
+from steam.game_servers import _handle_a2s_response, a2s_rules
+
+
+def compressed_packet(data, checksum=None, size=None):
+    if checksum is None:
+        checksum = crc32(data) & 0xffffffff
+    if size is None:
+        size = len(data)
+    return (pack('<lLBB', -2, 0x80000001, 1, 0)
+            + pack('<LL', size, checksum) + bz2.compress(data))
+
+
+class TestCompressedA2SResponse(unittest.TestCase):
+    @mock.patch('socket.socket')
+    def test_rules_with_checksum_high_bit(self, socket_class):
+        data = b'\xff\xff\xff\xffE\x01\x00key\x00one\x00'
+        self.assertGreater(crc32(data) & 0xffffffff, 0x7fffffff)
+        socket_class.return_value.recv.side_effect = [
+            b'\xff\xff\xff\xffA\x01\x02\x03\x04',
+            compressed_packet(data),
+        ]
+
+        self.assertEqual({'key': 'one'}, a2s_rules(('addr', 1234)))
+        socket_class.return_value.close.assert_called_once_with()
+
+    def test_checksum_without_high_bit(self):
+        data = b'\xff\xff\xff\xffE\x01\x00key\x00value\x00'
+        self.assertLess(crc32(data) & 0xffffffff, 0x80000000)
+        sock = mock.Mock()
+        sock.recv.return_value = compressed_packet(data)
+
+        self.assertEqual(data, _handle_a2s_response(sock))
+
+    def test_signed_crc32_result(self):
+        data = b'\xff\xff\xff\xffE\x01\x00key\x00one\x00'
+        sock = mock.Mock()
+        sock.recv.return_value = compressed_packet(data)
+        # Python 2 returns a signed crc32; compare the same 32-bit pattern.
+        with mock.patch('steam.game_servers.crc32',
+                        return_value=crc32(data) - 0x100000000):
+            self.assertEqual(data, _handle_a2s_response(sock))
+
+    def test_corrupted_checksum_still_rejected(self):
+        data = b'\xff\xff\xff\xffE\x01\x00key\x00one\x00'
+        sock = mock.Mock()
+        sock.recv.return_value = compressed_packet(
+            data, checksum=(crc32(data) & 0xffffffff) ^ 1)
+
+        with self.assertRaises(RuntimeError) as raised:
+            _handle_a2s_response(sock)
+        self.assertIn('Response checksum mismatch', str(raised.exception))
+
+    def test_wrong_decompressed_size_still_rejected(self):
+        data = b'\xff\xff\xff\xffE\x01\x00key\x00one\x00'
+        sock = mock.Mock()
+        sock.recv.return_value = compressed_packet(data, size=len(data) + 1)
+
+        with self.assertRaises(RuntimeError) as raised:
+            _handle_a2s_response(sock)
+        self.assertIn('Response size mismatch', str(raised.exception))